Privacy Policy for FIT COD & RTO Shield
Effective Date: January 1, 2026 • Last Updated: October 2026 • Application Slug: cod-rto-shield
1. Introduction & Scope
This Privacy Policy describes how FIT Apps ("we", "us", or "our") collects, processes, stores, and protects merchant and customer data when you install or use the FIT COD & RTO Shield application on your e-commerce store.
2. API Scopes & Information We Access
To deliver its core functionality (Cash on delivery verification, OTP & RTO fraud prevention.), FIT COD & RTO Shield requests only the minimum required API permissions:
read_orders- Used strictly to synchronize and process store records configured by the merchant inside FIT COD & RTO Shield.write_orders- Used strictly to synchronize and process store records configured by the merchant inside FIT COD & RTO Shield.read_customers- Used strictly to synchronize and process store records configured by the merchant inside FIT COD & RTO Shield.
3. Mandatory GDPR & Privacy Webhooks
FIT COD & RTO Shield implements and verifies all mandatory privacy webhooks using HMAC-SHA256 cryptographic validation:
customers/data_request: Exports all stored records associated with the requested customer ID within 72 hours.customers/redact: Permanently anonymizes and purges personal customer data upon request.shop/redact: Automatically deletes all store configuration tokens, logs, and cached metadata within 48 hours of app uninstallation.
4. Infrastructure Security & Data Retention
All data transmitted by FIT COD & RTO Shield is encrypted in transit via TLS 1.3 and encrypted at rest (AES-256) on Google Cloud Run infrastructure. We never sell, rent, or monetize merchant or buyer data.
5. Data Protection Officer & Contact
For privacy inquiries, data subject access requests (DSAR), or security audits regarding FIT COD & RTO Shield, contact our Data Protection Officer at support@fit-apps.dev.